Add Windows Admin Center module (77-WindowsAdminCenter) - #44
Merged
Conversation
New module 77 installs and configures the Windows Admin Center gateway on
this host. Reachable from Roles & Features -> [13] Windows Admin Center and
via the WACSetup / WACStatus CLI actions.
* Install the gateway from an operator-provided MSI (default) or, opt-in and
confirmed, a download from Microsoft's official aka.ms URL. In BOTH cases
the MSI must pass an Authenticode check (signature Valid AND signed by
"O=Microsoft Corporation") before msiexec runs, with an optional SHA-256
pin — re-verified inside the Dry-Run Apply closure so a swapped file can't
slip through (no TOCTOU). The install binds a port (443 default, 6516
offered) + a TLS cert (existing LocalMachine thumbprint, or installer-
generated self-signed) and opens the firewall.
* Status (WACStatus): JSON-aware service / port / listening state.
* Uninstall: reversible (resolves the product code, msiexec /x).
Every state change is Dry-Run-aware and reversible — the install undo runs
msiexec /x and removes the firewall rule RackStack opened (Domain+Private
only; never operator/system rules). RackStack installs no unverified binary.
Wired into the loader, Header action set, entry-point dispatch (WACSetup /
WACStatus), Roles & Features menu (item 13), and menu runner. Module count
77 -> 78; CLI actions 189 -> 191; README / Help / dist counts updated in
lockstep (now enforced by the doc-freshness guard). 5025 tests, 0 failures;
PSScriptAnalyzer clean.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
New module 77-WindowsAdminCenter installs and configures the Windows Admin Center gateway. Reachable from Roles & Features → [13] Windows Admin Center and via
WACSetup/WACStatus.aka.msURL. In both cases the MSI must pass an Authenticode check (signature Valid and signed byO=Microsoft Corporation) beforemsiexecruns, with an optional SHA-256 pin. Binds a port (443 default, 6516 offered) + a TLS cert (existing LocalMachine thumbprint, or installer-generated self-signed), and opens the firewall.WACStatus): JSON-aware service / port / listening state.msiexec /x).Security
msiexec /xand removes the firewall rule RackStack opened (Domain+Private only; never operator/system rules).msiexecargs are passed as a discrete array (no injection); operator MSI paths are validated (rooted,.msi, no traversal/reparse).Validation
Note
WAC's product packaging is shifting; this is a clean local-gateway install. Extension management and Azure-connected WAC are intentionally out of scope.